aboutsummaryrefslogtreecommitdiffstats
path: root/src/remake/api.rs
Commit message (Collapse)AuthorAgeFilesLines
* remake: turning a running swarm strict, keeping what an operator signedtv3 days1-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Until a swarm is strict, the user a change names is its node's word, so any member could have planted registry entries, policy, bans or user-signed values as any user, plain or signed by a key it put there itself; writing the strict policy trusted all of it as it was. A remake of a new kind, `strict`, turns a swarm strict instead: * Its content is a manifest (access::strict): the swarm, the strict policy, and each value kept at the places values are signed, by the SHA-256 of its JSON, signed by an operator (ssh-keygen -Y sign -n continuum-strict). * Every node builds the next epoch as compaction does, keeping at the signed places only the values the manifest names, as they were at the base, and writing its policy (RemakeKind::protocol, the one kind that changes protocol data). Writes after the base reach the new epoch only by replays, judged by the strict policy. * A node votes for one only with its manifest signed by one of --strict-keys, keys given out of the document; without any, for none (logged once, `Not voting for a strict remake`), unless --follow-strict-remakes. A coordinator proposes only what it would vote for (403). Once a majority commits one, every node switches, as with any remake: refusing to switch would only cut a node off. * GET /admin/strict-manifest gives the manifest keeping everything held now, the values for review and the heads they are at; continuum-signed strict shows them, signs once confirmed and proposes at those heads. The sim a_swarm_turning_strict_through_a_remake: a member plants a registry entry as a manager; the operator's manifest leaves it out; a and b, given the key, commit; c, without, follows; the entry is gone and the policy strict everywhere.
* dashboard: remake switch delaytv5 days1-1/+1
|
* remake: decouple grace time from node's keepalivetv10 days1-0/+1
|
* api: off clock refuses aborting expired remaketv10 days1-14/+29
|
* remake coordination use document, not automergetv11 days1-1/+1
|
* remake needs sane clocktv11 days1-1/+18
|
* remake: move proposal to its own moduletv12 days1-251/+5
|
* describe remake test failures in simulationtv2026-10-261-0/+30
|
* add remake tests on the simulatortv2026-10-261-0/+55
|
* allow aborting remake with unreachable coordiantortv2026-10-261-4/+26
|
* wrap unix timestamps in newtypetv2026-10-261-16/+17
|
* allow humand-friendly durations in APItv2026-10-261-7/+28
|
* remove /admin/compaction endpointtv2026-10-261-22/+3
|
* remove unit suffixes from fieldstv2026-10-261-27/+30
|
* unify API error responsestv2026-10-261-12/+1
|
* add clock moduletv2026-10-251-7/+8
| | | | | The Clock module is the system clock that every unix timestamp new goes through. It comes with an offset that only tests can set.
* bump abort margin & allow aborting active remaketv2026-10-251-38/+174
|
* add force module usable by API and CLItv2026-10-251-40/+7
|
* compact remake fixes base at the committv2026-10-241-17/+29
| | | | | | | Instead of fixing base heads at when proposed, compact fixes them when committing. This shrinks the window where writes can be lost if their author restarts to the switch delay; during replace and import remakes writes can still be lost during the voting period.
* allow superseding expired remakestv2026-10-241-23/+188
|
* add votes registertv2026-10-241-4/+25
|
* put remake content into blobstv2026-10-241-12/+16
|
* introduce majority voting on remakestv2026-10-241-42/+27
|
* allow import remake using the raw documenttv2026-10-241-6/+85
|
* add the import kind of remaketv2026-10-241-2/+8
|
* rename cluster to swarm everywhere!tv2026-10-211-2/+2
|
* make remake switch delay configurabletv2026-10-211-1/+33
|
* add the replace kind of remaketv2026-10-211-1/+11
| | | | | | | | | | | | | | POST /admin/remakes accepts specs with replace kind, e.g.: { "kind": "replace", "baseHeads": ["..."], "spec": { "document": { "accounts": { ... } }, "rules": [ { "from": "users", "to": "accounts" }, { "from": "users/admin", "drop": true }, { "from": "", "to": "" } ] } }
* allow choosing the base in remakestv2026-10-211-4/+53
| | | | | | | | | POST /admin/remakes accepts "baseHeads": ["<hex>", ...], for example the heads of an earlier GET /store?heads=true. Every head must be in the coordinating node's document, otherwise the request gets a 400. Without it, the base is the current heads. This works for any kind.
* turn compaction into a kind of remaketv2026-10-211-2/+55
|
* rename compaction to remaketv2026-10-211-0/+474