Persist retryable post-publish cleanup obligations

internal/manifest/manifest.go

@@ -57,23 +57,43 @@ type StageRecord struct {
 	Metadata         map[string]any   `json:"metadata,omitempty"`
 }
 
+// CleanupTarget records one root-confined local deletion requested by a
+// committed publication.
+type CleanupTarget struct {
+	Policy    string `json:"policy"`
+	Root      string `json:"root"`
+	Path      string `json:"path"`
+	Completed bool   `json:"completed"`
+}
+
+// PostPublishCleanup records the durable deletion work left by a committed
+// publish. It remains after completion as evidence of the exact committed run
+// and local paths involved.
+type PostPublishCleanup struct {
+	CommittedRunID          string          `json:"committed_run_id"`
+	RemoteCommitKey         string          `json:"remote_commit_key"`
+	CurrentCommitPointerKey string          `json:"current_commit_pointer_key"`
+	Targets                 []CleanupTarget `json:"targets"`
+}
+
 // Manifest is the durable run-state record for a session execution.
 type Manifest struct {
-	SessionID       string                  `json:"session_id"`
-	Campaign        string                  `json:"campaign,omitempty"`
-	RunID           string                  `json:"run_id,omitempty"`
-	LocalWorkDir    string                  `json:"local_workdir,omitempty"`
-	LocalSpoolDir   string                  `json:"local_spool_dir,omitempty"`
-	S3Bucket        string                  `json:"s3_bucket,omitempty"`
-	S3SessionPrefix string                  `json:"s3_session_prefix,omitempty"`
-	S3RunPrefix     string                  `json:"s3_run_prefix,omitempty"`
-	PipelineVersion string                  `json:"pipeline_version,omitempty"`
-	CreatedAt       time.Time               `json:"created_at"`
-	UpdatedAt       time.Time               `json:"updated_at"`
-	LastError       *ErrorRecord            `json:"last_error,omitempty"`
-	Inputs          []InputRecord           `json:"inputs,omitempty"`
-	Artifacts       []ArtifactRecord        `json:"artifacts,omitempty"`
-	Stages          map[string]*StageRecord `json:"stages"`
+	SessionID          string                  `json:"session_id"`
+	Campaign           string                  `json:"campaign,omitempty"`
+	RunID              string                  `json:"run_id,omitempty"`
+	LocalWorkDir       string                  `json:"local_workdir,omitempty"`
+	LocalSpoolDir      string                  `json:"local_spool_dir,omitempty"`
+	S3Bucket           string                  `json:"s3_bucket,omitempty"`
+	S3SessionPrefix    string                  `json:"s3_session_prefix,omitempty"`
+	S3RunPrefix        string                  `json:"s3_run_prefix,omitempty"`
+	PipelineVersion    string                  `json:"pipeline_version,omitempty"`
+	CreatedAt          time.Time               `json:"created_at"`
+	UpdatedAt          time.Time               `json:"updated_at"`
+	LastError          *ErrorRecord            `json:"last_error,omitempty"`
+	Inputs             []InputRecord           `json:"inputs,omitempty"`
+	Artifacts          []ArtifactRecord        `json:"artifacts,omitempty"`
+	Stages             map[string]*StageRecord `json:"stages"`
+	PostPublishCleanup *PostPublishCleanup     `json:"post_publish_cleanup,omitempty"`
 }
 
 // New constructs a new manifest with deterministic timestamps.

internal/manifest/store.go

@@ -107,6 +107,9 @@ func (s *LocalStore) Save(ctx context.Context, path string, m *Manifest) error {
 	if err := validateManifestIdentities(m.SessionID, m.Campaign, m.RunID); err != nil {
 		return fmt.Errorf("save manifest: %w", err)
 	}
+	if err := validatePostPublishCleanup(m.PostPublishCleanup); err != nil {
+		return fmt.Errorf("save manifest: %w", err)
+	}
 
 	m.UpdatedAt = time.Now().UTC()
 	if m.Stages == nil {
@@ -244,6 +247,9 @@ func validateLoadedManifest(m *Manifest) error {
 	if err := validateManifestIdentities(m.SessionID, m.Campaign, m.RunID); err != nil {
 		return err
 	}
+	if err := validatePostPublishCleanup(m.PostPublishCleanup); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -263,6 +269,27 @@ func normalizeManifest(m *Manifest) {
 	}
 }
 
+func validatePostPublishCleanup(cleanup *PostPublishCleanup) error {
+	if cleanup == nil {
+		return nil
+	}
+	if err := pathsafe.ValidateOpaqueSegment(cleanup.CommittedRunID); err != nil {
+		return fmt.Errorf("post_publish_cleanup.committed_run_id is not a portable opaque identifier: %w", err)
+	}
+	if strings.TrimSpace(cleanup.RemoteCommitKey) == "" || strings.TrimSpace(cleanup.CurrentCommitPointerKey) == "" {
+		return fmt.Errorf("post_publish_cleanup commit identity is required")
+	}
+	if len(cleanup.Targets) == 0 {
+		return fmt.Errorf("post_publish_cleanup.targets is required")
+	}
+	for index, target := range cleanup.Targets {
+		if strings.TrimSpace(target.Policy) == "" || strings.TrimSpace(target.Root) == "" || strings.TrimSpace(target.Path) == "" {
+			return fmt.Errorf("post_publish_cleanup.targets[%d] policy, root, and path are required", index)
+		}
+	}
+	return nil
+}
+
 func validateLoadedRunManifest(m *RunManifest) error {
 	if m == nil {
 		return fmt.Errorf("manifest is nil")