Repository navigation

Persistent drive leases, reconciliation, NAS persistence, protocol rig, compat capture, MFA pending, capacity budget - #46

Merged

github-actions[bot] merged 242 commits into

masterfrom

feat/persistent-drive-leases

Oct 11, 2026

Merged

Persistent drive leases, reconciliation, NAS persistence, protocol rig, compat capture, MFA pending, capacity budget#46
github-actions[bot] merged 242 commits into
masterfrom
feat/persistent-drive-leases

Commits on Oct 9, 2026
- docs: spec for persistent drive leases with fencing and restart recovery (roadmap 7/8)
  
  Amantux
  and
  claude
  committed
  c20661d
- feat(catalog): drive_leases table and repository lease API
  
  Amantux
  and
  claude
  committed
  6276db4
- feat(jobs): DriveScheduler over a LeaseStore, with fencing verify/heartbeat
  
  Amantux
  and
  claude
  committed
  605978e
- feat(jobs): fence sharded archive on drive leases (partial slice of step 3)
  
  Amantux
  and
  claude
  committed
  6502793
- feat(jobs): bind every scheduler to the catalog lease store; fence block-stripe writes
  
  Amantux
  and
  claude
  committed
  f364623
- feat(jobs): recover_after_restart reconciles jobs and drive leases (report-only)
  
  Amantux
  and
  claude
  committed
  b4c32e7
- feat(jobs): run restart recovery in create_context and expose it at GET /jobs/recovery
  
  Amantux
  and
  claude
  committed
  4e67682
- docs: architecture section for drive leases/recovery; record implementation deviations in the spec
  
  Amantux
  and
  claude
  committed
  de4f999
- fix(catalog): run lease operations on their own session, not the shared one
  
  Amantux
  and
  claude
  committed
  096a2bf
- fix(recovery): act only on expired leases — never fail a job another process may own
  
  Amantux
  and
  claude
  committed
  e2443f2
- fix(jobs): fenced-out jobs leave the drive alone; background heartbeat; persist physical drive
  
  Amantux
  and
  claude
  committed
  5f2ba33
- docs(spec): record the review-driven recovery scoping and fenced-out cleanup rules
  
  Amantux
  and
  claude
  committed
  47dc550
- feat(domain): add STAGING and VERIFYING file-instance states
  
  Amantux
  and
  claude
  committed
  da84f5b
- ci(operability): pin actions to full commit SHAs
  
  Amantux
  and
  claude
  committed
  7ff9ba9
- feat(domain): model placement, striping and protection as separate axes
  
  Amantux
  and
  claude
  committed
  9432278
- ci: add nightly/manual NAS protocol rig workflow
  
  Amantux
  and
  claude
  committed
  daff4da
- docs: describe NAS protocol test rig
  
  Amantux
  and
  claude
  committed
  de01abe
- docs: rewrite tech-debt with verified state; document CI lanes
  
  Amantux
  and
  claude
  committed
  58d0f04
- feat(nas): render full smb.conf and Ganesha config from NasShare records
  
  Amantux
  and
  claude
  committed
  ef6bc31
- feat(deploy): read-only appliance postcheck and digest rollback
  
  Amantux
  and
  claude
  committed
  870e836
- feat(fuse): byte-budget LRU cache and batching Hydrator over the restore service
  
  Amantux
  and
  claude
  committed
  64bb29e
- feat(fuse): state xattr, open-handle refcount, blocking/EAGAIN hydration, unmount shutdown
  
  Amantux
  and
  claude
  committed
  331adbf
- ci: pin actions to SHAs and scope permissions per job
  
  Amantux
  and
  claude
  committed
  0babc3a
- ci: consolidate emulator boot/test into reusable workflow (SHA-pinned)
  
  Amantux
  and
  claude
  committed
  0ff26ed
- ci: add workflow-lint (actionlint, zizmor, shellcheck, yamllint)
  
  Amantux
  and
  claude
  committed
  045d3c1
- feat(nas): protocol gateway on_open/on_read_range/on_close/on_evict over the Hydrator
  
  Amantux
  and
  claude
  committed
  e5b444e
- feat(nas): manifest v2 with commit marker written last and generation chain
  
  Amantux
  and
  claude
  committed
  62deb3f
- ci(release): build-once digest pipeline with SBOM, scan, signing and staged deploy
  
  Amantux
  and
  claude
  committed
  79f4e6e
- docs: release runbook and digest-pinned deployment examples
  
  Amantux
  and
  claude
  committed
  82d6688
- merge: fleet/release-pipeline (roadmap item 24)
  
  Amantux
  and
  claude
  committed
  ef5a7be
- ci(hardware): add rig-guarded read-only and destructive i3 lanes; rehearse allowlist+snapshot on mhvtl
  
  Amantux
  and
  claude
  committed
  bb6aeff
- docs(hardware): runbook for self-hosted i3 lanes; gate write paths on the drive-identity bridge
  
  Amantux
  and
  claude
  committed
  8e23d57
- feat(nas): cartridge lifecycle state machine with typed invalid transitions
  
  Amantux
  and
  claude
  committed
  bf072c6
- feat(nas): LTO compat matrix, foreign-media guard and reservations in archive planner
  
  Amantux
  and
  claude
  committed
  99e2c6e
- feat(nas): scratch, fragmentation, reservation, replication, span, export and drive planning models
  
  Amantux
  and
  claude
  committed
  5d5e98a
- docs(nas): document tape-native planning models
  
  Amantux
  and
  claude
  committed
  2e4eb31
- fix(fuse): never budget-evict the entry just stored for a waiting reader
  
  Amantux
  and
  claude
  committed
  58827b3
- test(fuse): data-plane integration tests (hydrate, tickets, timeout, eviction, failure, batching, restart, unmount)
  
  Amantux
  and
  claude
  committed
  d465a5e
- build: install fuse3/libfuse3 so the FUSE mount works in the shipped image
  
  Amantux
  and
  claude
  committed
  6190584
- test(i3): Clock abstraction and fault-shaped timing profiles
  
  Amantux
  and
  claude
  committed
  a06aeb0
- docs(fuse): describe the five data-plane layers honestly; correct the wiki gap list
  
  Amantux
  and
  claude
  committed
  f22c4a8
- test: register contract marker and make test-contract target
  
  Amantux
  and
  claude
  committed
  4c75df3
- test: backend contract suite across sim, in-process emulator and real pairings
  
  Amantux
  and
  claude
  committed
  39a27f8
- docs: document the backend contract suite and new-backend rule
  
  Amantux
  and
  claude
  committed
  ecf2052
- docs: protection axis table and commit-marker recovery rules
  
  Amantux
  and
  claude
  committed
  1dc34c0
- feat(nas): rebuild skips uncommitted generations and reports missing siblings
  
  Amantux
  and
  claude
  committed
  f790ba5
- merge: fleet/contract-suite (roadmap item 5)
  
  Amantux
  and
  claude
  committed
  a9ccc50
- feat(hardware): resolve_tape_by_id maps a drive serial to its /dev/tape/by-id link (read-only)
  
  Amantux
  and
  claude
  committed
  7feed22
- feat(tools): sacrificial-barcode allowlist gate and inventory/drive snapshot+diff for hardware lanes
  
  Amantux
  and
  claude
  committed
  5492fcc
- test(hardware): read-only rig suite, drive-identity bridge, and AST guard forbidding motion in readonly/
  
  Amantux
  and
  claude
  committed
  7f8389f
- ci(hardware): pass appliance config to rig jobs and fail preflight instead of skipping green
  
  Amantux
  and
  claude
  committed
  2105632
- fix(scalar_http): refuse unload while the host-side LTFS state is mounted or dirty
  
  Amantux
  and
  claude
  committed
  46d5a74
- merge: fleet/tape-manifest (roadmap items 9, 10)
  
  Amantux
  and
  claude
  committed
  b6c71b6
- feat(catalog): job journal and staged-instance lifecycle methods
  
  Amantux
  and
  claude
  committed
  8d3cded
- test(integration): rendezvous all three lease holders before asserting disjoint drive ownership
  
  Amantux
  and
  claude
  committed
  3389085
- fix(nas): Ganesha config disables NLM/RQUOTA for the NFSv4-only export
  
  Amantux
  and
  claude
  committed
  24dbb32
- feat(deploy): containerised Samba + NFS-Ganesha protocol rig with hydrator shim
  
  Amantux
  and
  claude
  committed
  3278209
- test(e2e): SMB/NFS protocol scenarios, protocols marker, make targets
  
  Amantux
  and
  claude
  committed
  286e1d8
- merge: fleet/nas-models (roadmap item 20)
  
  Amantux
  and
  claude
  committed
  bb1aee3
- feat(aml-auth): session cap, strict 412, XML login negotiation, Retry-After
  
  Amantux
  and
  claude
  committed
  42bfac4
- docs(compat): inferred auth cases, iblade-rev-a scaffold, auth contract notes
  
  Amantux
  and
  claude
  committed
  8bc5fd7
- test(hardware): format LTFS test tapes via FormatService dry-run + token, never raw mkltfs
  
  Amantux
  and
  claude
  committed
  367d39c
- test(hardware): enforce read-only at runtime (HTTP + argv allowlists) and harden the AST motion guard
  
  Amantux
  and
  claude
  committed
  cd361fb
- feat(tools): junit skip gate, normalized allowlist output, snapshot refuses dry-run backend
  
  Amantux
  and
  claude
  committed
  5351b3e
- ci(hardware): gate rig lanes on junit (no skip-as-pass), job-level rig lock, pin dry-run off
  
  Amantux
  and
  claude
  committed
  06b740d
- merge: fleet/jobs-atomic
  
  Amantux
  and
  claude
  committed
  746742b
- merge: fleet/aml-auth
  
  Amantux
  and
  claude
  committed
  de4d69b
- merge: fleet/hardware-lane
  
  Amantux
  and
  claude
  committed
  fe78300
- fix(nas): render Ganesha Clients unquoted so EXPORTs load
  
  Amantux
  and
  claude
  committed
  51e19e3
- fix(e2e): stage guest-writable .ob-control/offline for recall requests
  
  Amantux
  and
  claude
  committed
  68a5d40
- test(e2e): assert smbcacls owner/group/everyone ACEs for mode 0640
  
  Amantux
  and
  claude
  committed
  135a92e
- docs(deploy): note the catalog has no on-disk OFFLINE_ON_TAPE form
  
  Amantux
  and
  claude
  committed
  1cce6d3
- sharded_archive: stage instances, one bulk commit, journal physical_state_unknown
  
  Amantux
  and
  claude
  committed
  6e9d958
- feat(jobs): take non-sharded archive/restore drives through DriveScheduler leases
  
  Amantux
  and
  claude
  committed
  a128e02
- feat(api,cli): pass the shared lease-store scheduler to run_archive_job/run_restore_job
  
  Amantux
  and
  claude
  committed
  579628e
- fix(api): AML error envelope keeps exception headers and covers unhandled 500s
  
  Amantux
  and
  claude
  committed
  ddaed9d
- sharded_restore: journal physical_state_unknown instead of suppressing cleanup errors
  
  Amantux
  and
  claude
  committed
  a96533c
- test(jobs): lease contention and stale-lease fencing for non-sharded archive/restore
  
  Amantux
  and
  claude
  committed
  02cc807
- test: staged sharded archive never archives on lane failure; cleanup journals physical_state_unknown
  
  Amantux
  and
  claude
  committed
  c94cd6c
- merge: fleet/jobs-leases (leases for the non-sharded paths)
  
  Amantux
  and
  claude
  committed
  e1c030d
- merge: fleet/jobs-sharded (staged commit, no suppressed cleanup errors)
  
  Amantux
  and
  claude
  committed
  ea2621d
- fix(nas): gateway on_open pins every open so on_close cannot drop another handle's pin
  
  Amantux
  and
  claude
  committed
  a4245bc
- fix(jobs): never attempt an unload after a failed unmount; curate route error text; lease tree-restore children
  
  Amantux
  and
  claude
  committed
  0e3d145
- feat(rebuild): structured uncommitted_generations and missing_siblings in rebuild plan
  
  Amantux
  and
  claude
  committed
  1845198
- test(jobs): a drive whose unmount failed is never asked to unload
  
  Amantux
  and
  claude
  committed
  e61a029
- feat(nas): NasPool.protection explicit policy; protection_from_pool prefers it
  
  Amantux
  and
  claude
  committed
  4b24933
- fix(fuse): hydration workers complete tickets on any engine error
  
  Amantux
  and
  claude
  committed
  5750f09
- fix(fuse): resume() re-reads the job each poll and stops at a deadline
  
  Amantux
  and
  claude
  committed
  4d3782d
- feat(rebuild): recover dataset protection policy into nas_datasets.protection_json
  
  Amantux
  and
  claude
  committed
  fc08942
- feat(recovery): report staged instances and stale pending jobs
  
  Amantux
  and
  claude
  committed
  2df1d67
- test(compat): raw body, content_type, repeat and expected.headers in corpus harness
  
  Amantux
  and
  claude
  committed
  4c213b9
- docs: record phase-2 recovery report fields and staged-commit follow-up
  
  Amantux
  and
  claude
  committed
  f91518e
- test(e2e): rewrite asserts in protocol scenarios so failures show values
  
  Amantux
  and
  claude
  committed
  e4a3fce
- fix(nas): disable oplocks/SMB2 leases so SMB clients see hydrated files
  
  Amantux
  and
  claude
  committed
  966d399
- fix(e2e): tolerate .req vanishing mid-create under concurrent SMB recalls
  
  Amantux
  and
  claude
  committed
  bd9dffe
- fix(fuse): waiters pin the cache entry so a batch cannot evict it unread
  
  Amantux
  and
  claude
  committed
  9a1f977
- docs: scope phase-2 follow-up to what this branch carries
  
  Amantux
  and
  claude
  committed
  67a7440
- docs(nas): correct protocol rig mounts/ports and record SMB caching semantics
  
  Amantux
  and
  claude
  committed
  8d677c0
- fix(fuse): shutdown never strands a racing ticket; one overall wait deadline
  
  Amantux
  and
  claude
  committed
  c81e74e
- merge: fleet/jobs-recovery (recovery report: staged instances, stale pending)
  
  Amantux
  and
  claude
  committed
  a98947e
- fix(recovery): keep live leases whose owner is still pending
  
  Amantux
  and
  claude
  committed
  d9894e5
- fix(fuse): delete the staging copy after a verified store or checksum failure
  
  Amantux
  and
  claude
  committed
  cc35a6e
- ci: add changed-path ownership check (tools/ci_ownership.py)
  
  Amantux
  and
  claude
  committed
  b18c7b6
- ci: SHA-pin ci.yml, add ownership job to ci-gate, drop stale advisory comment
  
  Amantux
  and
  claude
  committed
  22d6f41
- test: add stress/fuzz/rebuild/mutation markers, enable --strict-markers
  
  Amantux
  and
  claude
  committed
  953b18e
- ci: add mutmut mutation lane with survivor ratchet baseline
  
  Amantux
  and
  claude
  committed
  d8afb6e
- ci: add nightly slow/stress/fuzz/rebuild/mutation lanes
  
  Amantux
  and
  claude
  committed
  823d8e1
- merge: fleet/nas-protocols (roadmap item 19)
  
  Amantux
  and
  claude
  committed
  026b280
- merge: fleet/ci-hardening (roadmap items 11-17)
  
  Amantux
  and
  claude
  committed
  7a6b86f
- ci: persist-credentials=false on every checkout; zizmor/actionlint/yamllint clean across all workflows
  
  Amantux
  and
  claude
  committed
  0744515
- merge: fleet/manifest-wiring (rebuild policy persistence, compat harness headers)
  
  Amantux
  and
  claude
  committed
  95919e6
- merge: fleet/fuse-plane (roadmap item 21)
  
  Amantux
  and
  claude
  committed
  57a9eed
- fix(verify): skip STAGING/VERIFYING instances — recovery owns them, not the verify job
  
  Amantux
  and
  claude
  committed
  5fb1d29
- fuse: hydrator worker threads use a private catalog Session
  
  Amantux
  and
  claude
  committed
  c25258e
- fuse: `fuse mount --hydrate` builds the batched Hydrator data plane
  
  Amantux
  and
  claude
  committed
  94bee9b
- docs(fuse): CLI data plane and per-thread sessions are now real
  
  Amantux
  and
  claude
  committed
  aea8421
- test: own the contract suite and protocol render test; bridge test expects curated job errors
  
  Amantux
  and
  claude
  committed
  6a57f3a
- ci(emulator-gates): keep the contract-pinned validation command as an explicit step
  
  Amantux
  and
  claude
  committed
  caa6ae6
- docs(roadmap): verified per-item status after the 2026-10-09 fleet integration
  
  Amantux
  and
  claude
  committed
  7df5cb5
- merge: fleet/fuse-wiring (per-thread sessions, CLI data plane)
  
  Amantux
  and
  claude
  committed
  91359c6
- feat(fuse): OPENBLADE_FUSE_CACHE_MAX_BYTES bounds the hydration cache in the CLI data plane
  
  Amantux
  and
  claude
  committed
  e107415
- feat(restore): run_restore_batch -- one lease/load/mount/unload per source tape
  
  Amantux
  and
  claude
  committed
  3f8a751
- feat(fuse): JobRestoreEngine submits one restore job per tape batch
  
  Amantux
  and
  claude
  committed
  f089e77
- docs(fuse): one restore job (one tape load) per hydration batch
  
  Amantux
  and
  claude
  committed
  a218709
- chore: replace deprecated datetime.utcnow() with domain.clock.naive_utcnow
  
  Amantux
  and
  claude
  committed
  96c3b33
- fix(safety): unload gates for real hardware and across processes
  
  Amantux
  and
  claude
  committed
  6e58d5b
- fix(jobs): ArchiveService schedules through the catalog lease store
  
  Amantux
  and
  claude
  committed
  1434785
- merge: fleet/fuse-batch (one tape load per hydration batch)
  
  Amantux
  and
  claude
  committed
  f41bf6b
- fix(jobs): RestoreService schedules through the catalog lease store (single and batch)
  
  Amantux
  and
  claude
  committed
  84a41ef
- fix(jobs): curated physical-state error text; failure-path journaling never masks the lane error
  
  Amantux
  and
  claude
  committed
  e78f155
- chore: finish the utcnow sweep (column defaults, gateway); refresh tech-debt and the stale format note
  
  Amantux
  and
  claude
  committed
  e098d1c
- fix(nas): hash on-tape bytes for commit markers, not a model re-dump
  
  Amantux
  and
  claude
  committed
  7175adc
- fix(fuse): restarted hydrator finds and resumes batch restore jobs
  
  Amantux
  and
  claude
  committed
  312f191
- fix(nas): gateway on_open returns a handle token; on_close releases only it
  
  Amantux
  and
  claude
  committed
  0bc5e58
- perf(fuse): O(length) range reads via cache.read_range; typed CacheError
  
  Amantux
  and
  claude
  committed
  9a5d864
- fix(jobs): restore journals physical_state_unknown via the shared helper
  
  Amantux
  and
  claude
  committed
  1da44eb
- merge: fleet/review-fixes (second adversarial review)
  
  Amantux
  and
  claude
  committed
  feae684
- docs(fuse): gateway handle-token semantics
  
  Amantux
  and
  claude
  committed
  30c1354
- fix(protocols): rig survives malformed stubs and resets offline stubs on reuse
  
  Amantux
  and
  claude
  committed
  c937589
Commits on Oct 10, 2026
- feat(reconcile): cross-job journal query and pending-reconciliation set
  
  Amantux
  and
  claude
  committed
  159419a
- fuse cache: per-entry integrity sidecar + open-time verify_entry
  
  Amantux
  and
  claude
  committed
  fcdd6ef
- feat(reconcile): refuse unreconciled drives in scheduler and load helpers
  
  Amantux
  and
  claude
  committed
  b19fd7c
- test(protocols): real SMB byte-range lock conflict across two sessions
  
  Amantux
  and
  claude
  committed
  9bab58f
- test(mutation): add validator/import-guard/safety/policy tests to mutmut selection
  
  Amantux
  and
  claude
  committed
  3919499
- feat(reconcile): reconcile_drive action, recovery report field, API route
  
  Amantux
  and
  claude
  committed
  bd27981
- test: add StatefulMtxRunner fake for the mtx changer CLI
  
  Amantux
  and
  claude
  committed
  f11f168
- fuse cache: persist LRU index across restarts
  
  Amantux
  and
  claude
  committed
  5047a03
- feat(emulator): env-driven AML fault profile parser and counters
  
  Amantux
  and
  claude
  committed
  1c965f1
- feat(catalog): persist NAS pool replication/protection and add NAS domain tables
  
  Amantux
  and
  claude
  committed
  de61888
- JobQueue: persist jobs in the catalog jobs table
  
  Amantux
  and
  claude
  committed
  144746e
- test(contract): add scsi+fake-ltfs pairing over RealLibraryBackend
  
  Amantux
  and
  claude
  committed
  21a5aab
- fuse cache: loop os.pread in read_range until length or EOF
  
  Amantux
  and
  claude
  committed
  7001c40
- feat(catalog): CRUD for persisted NAS reservations, export sets, vaults, VG replication, file spans
  
  Amantux
  and
  claude
  committed
  f834429
- docs(test-plan): add scsi+fake-ltfs to the contract pairing table
  
  Amantux
  and
  claude
  committed
  9ed7491
- fix(mutation): run mutmut's pytest sessions without capture
  
  Amantux
  and
  claude
  committed
  a931148
- test(mutation): baseline policies.py at 23 survivors (37 mutants, 52 s)
  
  Amantux
  and
  claude
  committed
  f7b26a3
- test: fuse cache integrity, restart index, chunked pread
  
  Amantux
  and
  claude
  committed
  2371edb
- test(protocols): un-skip NFS ACL scenario; pin Ganesha 4.3 ACL limit
  
  Amantux
  and
  claude
  committed
  64e1b36
- feat(nas): catalog-backed ReservationLedger and span-aware restore planning
  
  Amantux
  and
  claude
  committed
  481d35a
- test(reconcile): pending set, scheduler skip/refuse, load refusal, API; ADR note
  
  Amantux
  and
  claude
  committed
  3789b9a
- feat(api): expose pool replication/protection and NAS reservation, export-set, vault lists
  
  Amantux
  and
  claude
  committed
  e6621bc
- test(mutation): baseline recovery.py at 43 survivors (134 mutants, 129 s)
  
  Amantux
  and
  claude
  committed
  ba1a22f
- JobQueue: drive and changer claims are catalog leases
  
  Amantux
  and
  claude
  committed
  0aac146
- Test JobQueue jobs and claims across two catalog sessions
  
  Amantux
  and
  claude
  committed
  54b414a
- Docs: record the JobQueue persistent-lease follow-up
  
  Amantux
  and
  claude
  committed
  6d50b45
- test(mutation): baseline safety/import_guard.py at 20 survivors (86 mutants, 46 s)
  
  Amantux
  and
  claude
  committed
  e691a17
- test(mutation): baseline nas/manifest_validator.py at 74 survivors (255 mutants, 43 s)
  
  Amantux
  and
  claude
  committed
  b6ba865
- test(mutation): kill 32 survivors in policies/recovery, ratchet 23->2, 43->32
  
  Amantux
  and
  claude
  committed
  f36db67
- docs(mutation): 6/6 modules baselined (header + roadmap item 16)
  
  Amantux
  and
  claude
  committed
  392ff62
- Merge branch 'fleet2/reconcile' into feat/persistent-drive-leases
  Amantux
  committed
  f3087dd
- Merge branch 'fleet2/nas-persist' into feat/persistent-drive-leases
  Amantux
  committed
  d2f76b2
- Merge branch 'fleet2/cache-integrity' into feat/persistent-drive-leases
  Amantux
  committed
  f990785
- Merge branch 'fleet2/scsi-pairing' into feat/persistent-drive-leases
  Amantux
  committed
  f569d5b
- Merge branch 'fleet2/protocol-gaps' into feat/persistent-drive-leases
  Amantux
  committed
  15a8d16
- Merge branch 'fleet2/queue' into feat/persistent-drive-leases
  Amantux
  committed
  4cf1e57
- Merge branch 'fleet2/mutation-baseline' into fleet2/followup
  Amantux
  committed
  2d6df7a
- Merge branch 'fleet2/mutation-baseline' into feat/persistent-drive-leases
  Amantux
  committed
  7d0f5e6
- feat(emulator): AML fault hooks (reboot 503, load 409, checksum retry, session TTL)
  
  Amantux
  and
  claude
  committed
  f213c86
- Add targeted and exclude-aware drive lease acquisition
  
  Amantux
  and
  claude
  committed
  24b37f8
- test(i3): import fault presets from emulator; skip client faults when server-side
  
  Amantux
  and
  claude
  committed
  04c845e
- docs(emulator): document OPENBLADE_EMULATOR_FAULT_PROFILE in contract, compose, README
  
  Amantux
  and
  claude
  committed
  bf8a4e5
- Merge branch 'fleet2/emulator-faults' into feat/persistent-drive-leases
  Amantux
  committed
  9a38eec
- feat(emulator): wire AML fault profile into the latency middleware
  
  Amantux
  and
  claude
  committed
  e8795ee
- Claim queue drive/changer slots with targeted leases
  
  Amantux
  and
  claude
  committed
  59be7da
- Test that gateway on_open evicts a corrupt cache entry and re-hydrates
  
  Amantux
  and
  claude
  committed
  7bce7bb
- Merge branch 'fleet2/followup' into feat/persistent-drive-leases
  Amantux
  committed
  7a614e3
- chore(integration): round-2 merge fixes
  
  Amantux
  and
  claude
  committed
  02c52b4
- fix(fuse-cache): accept any checksum string for sample offset; reject unsafe cache keys
  
  Amantux
  and
  claude
  committed
  5d2cf35
- fix(job-queue): reconciliation barrier on claim_drive; heartbeat claims during run_job
  
  Amantux
  and
  claude
  committed
  7689ab8
- fix(jobs): fail closed when physical_state_unknown cannot be journaled (B1)
  
  Amantux
  and
  claude
  committed
  7a0c7d7
- fix(reconcile): order journal by id; exclude pending barcodes (S1, S2)
  
  Amantux
  and
  claude
  committed
  69f888b
- fix(nas-capacity): atomic reservation check-and-insert under BEGIN IMMEDIATE
  
  Amantux
  and
  claude
  committed
  29857ba
- fix(scheduler): refuse barcodes pending reconciliation
  
  Amantux
  and
  claude
  committed
  c042391
- Merge branch 'fleet2/fix-misc' into feat/persistent-drive-leases
  Amantux
  committed
  6feebc6
- fix(jobs): keep cleanup and the original lane error when lease release fails
  
  Amantux
  and
  claude
  committed
  d722f59
- fix(recovery): skip queue-claim leases in mismatch check; JournalWriteError is a SafetyViolationError
  
  Amantux
  and
  claude
  committed
  d3c1d75
- style: ruff format test_sharded_archive_atomicity.py (format-only)
  
  Amantux
  and
  claude
  committed
  e5ee704
- docs(decisions): reconciliation fail-closed rule, barcode exclusion, TTL residual
  
  Amantux
  and
  claude
  committed
  c13cf24
- Merge branch 'fleet2/fix-journal' into feat/persistent-drive-leases
  Amantux
  committed
  8dadd60
- docs: roadmap status 2026-10-10 and tech-debt after round-2 fleet
  
  Amantux
  and
  claude
  committed
  6db8d73
- fix(fuse-cache): only a whole-component ".." is an unsafe cache key
  
  Amantux
  and
  claude
  committed
  7435dd1
Commits on Oct 11, 2026
- feat(nas): planner refuses plans exceeding pool reservation budget
  
  Amantux
  and
  claude
  committed
  dfbd8f9
- feat(compat): add compat_capture replay/capture/diff tool with sanitizer
  
  Amantux
  and
  claude
  committed
  47470e5
- test(compat): sanitizer rules, provenance refusal and determinism for compat_capture
  
  Amantux
  and
  claude
  committed
  111b7e3
- feat(aml): mark MFA-required logins as pending sessions (inferred)
  
  Amantux
  and
  claude
  committed
  59066d2
- build(nas-protocols): serve NFS from Fedora 41 Ganesha 5.9 with VFS ACL mapping
  
  Amantux
  and
  claude
  committed
  eeb5291
- feat(nas): archive plans book a pool reservation against the budget
  
  Amantux
  and
  claude
  committed
  81effc5
- ci(mhvtl-weekly): run drive-identity bridge test in the no-LTFS suite cut
  
  Amantux
  and
  claude
  committed
  7c0d395
- docs(roadmap): item 23 bridge is implemented, not yet certified on metal
  
  Amantux
  and
  claude
  committed
  6f88b18
- test(protocols): assert a real NFSv4 DENY ACE is enforced over NFS
  
  Amantux
  and
  claude
  committed
  ca6e47a
- docs: NFSv4 ACL enforcement is now a real protocol-rig scenario
  
  Amantux
  and
  claude
  committed
  a41eb43
- feat(nas): scratch-stock health component and threshold API
  
  Amantux
  and
  claude
  committed
  17b4e51
- Merge fleet3/nfs-acl: real NFSv4 ACL scenario on the protocol rig
  Amantux
  committed
  0751fcf
- Merge fleet3/phase7: bridge test in mhvtl lane, roadmap item 23 corrected
  Amantux
  committed
  0b73709
- fix(compat): scrub XML-body tokens and cookie expiry; keep bad-password cases replayable
  
  Amantux
  and
  claude
  committed
  e9b2ff5
- test(compat): add 12 self-captured aml cases and self-captured source to harness
  
  Amantux
  and
  claude
  committed
  f848464
- docs(compat): appliance capture procedure, redaction list and self-capture loop
  
  Amantux
  and
  claude
  committed
  9497817
- Merge fleet3/capture: compatibility capture/sanitize tool, self-captured corpus
  Amantux
  committed
  db8766b
- feat(upload): share-push plans book a pool reservation like /nas/archive-plan
  
  Amantux
  and
  claude
  committed
  28a90ff
- feat(aml): gate MFA-pending sessions to the MFA challenge routes and logout
  
  Amantux
  and
  claude
  committed
  62ece7b
- test(i3): emulator-only MFA-pending session round trip
  
  Amantux
  and
  claude
  committed
  3764b78
- docs(aml): describe the inferred MFA-pending login state
  
  Amantux
  and
  claude
  committed
  4419c60
- feat(nas): release a plan's pool reservation when its ingest job ends
  
  Amantux
  and
  claude
  committed
  754fdc6
- Merge fleet3/mfa: inferred MFA-pending session state in the AML emulator
  Amantux
  committed
  8ef15e9
- docs: capacity reservations decision record, tech-debt, wiki api regen
  
  Amantux
  and
  claude
  committed
  56635cb
- test(compat): MFA setup hook + inferred MFA-pending login case
  
  Amantux
  and
  claude
  committed
  d6ee365
- docs(roadmap): refresh status rows 3, 18, 19, 22, 23 (as of 2026-10-11)
  
  Amantux
  and
  claude
  committed
  18b9faf
- Merge fleet3/followup: compat MFA setup hook + case, roadmap status rows
  Amantux
  committed
  544dd44
- Merge fleet3/capacity: pool reservation budget, booking + release, scratch health
  Amantux
  committed
  f06a92a
- fix(compat): sanitizer masks nested secret leaves, XML attrs, tagged elements
  
  Amantux
  and
  claude
  committed
  eb39446
- fix(nas): derive pool budget server-side; refuse client capacity inputs (B1)
  
  Amantux
  and
  claude
  committed
  e4d8d06
- fix(aml): MFA-pending login never changes status or body, strict mode too
  
  Amantux
  and
  claude
  committed
  6f3a44e
- build(nas): pin nfs-ganesha 5.9 in the Fedora stage
  
  Amantux
  and
  claude
  committed
  2f77cc2
- Merge fleet3/fix-misc: sanitizer nested/XML-attr/Basic leaks, MFA header-only signal, Ganesha pin
  Amantux
  committed
  36e7607
- fix(nas): book pool capacity at ingest start, not at plan preview (S2)
  
  Amantux
  and
  claude
  committed
  201ee40
- fix(nas): count scratch from library inventory; exclude VG members from pool budget (S1)
  
  Amantux
  and
  claude
  committed
  47e8e69
- fix(nas): never let a failed reservation release mask the ingest error (S3)
  
  Amantux
  and
  claude
  committed
  3b4722a
- fix(nas): release the plan booking when the ingest executor raises (S3 test)
  
  Amantux
  and
  claude
  committed
  ccf7107
- docs(nas): record server-derived budget, booking at start, inventory scratch
  
  Amantux
  and
  claude
  committed
  63761c8
- test(nas): stop sending available_tapes with pool in the e2e archive test
  
  Amantux
  and
  claude
  committed
  7d82885
- Merge fleet3/fix-capacity: server-derived pool budget (B1), booking at ingest start, inventory scratch, safe release
  Amantux
  committed
  144b7d0
- fix(demo): let the server derive the pool tape set in the MVP plan request
  
  Amantux
  and
  claude
  committed
  3841c59

Commits

Commits on Oct 9, 2026

Commits on Oct 10, 2026