aboutsummaryrefslogtreecommitdiffstats
path: root/src/remake
Commit message (Collapse)AuthorAgeFilesLines
* rules: a carried remake record taken from the coordinator its snapshot namestv3 days4-1/+10
| | | | | | | | | | | | | | | | | Review finding 7, second part: a record carried into a new epoch whole (proposal and decision in one change) was taken from any member, for any remake ID. A member could write a forged record, decision included, for a fresh ID in a single change. The snapshot's epoch metadata now names the remake's coordinator, as the quorum built it. The carried-record exception holds only in a later epoch, only for the remake that made it, and only from the coordinator its snapshot names, where there is no record yet. Wire version 43: the snapshot, and so the epoch ID, changes. The review suggested carrying the record inside the snapshot instead. The snapshot can't hold the decision, which names the snapshot's own hash. So the snapshot vouches for who may carry the record instead.
* remake: replays judged before they go intv3 days4-2/+118
| | | | | | | | | | | | | | | A switching or rejoining node replays late writes as fresh changes naming each write's user, and nothing judged them before they left: a replay every node would refuse (a revoked capability, a second envelope at a signed path, readers changed) was refused everywhere, and with it everything the node wrote after it. Under a policy, replay_newest now judges each group it commits as every node will (rules::judge_held, in the new epoch); one they would refuse is taken back (forked at the heads before it, same actor) and its paths quarantined with the reason. replay_newest takes the epoch. Review finding 3 (remake replays).
* remake: replay from the quarantine where the user may writetv3 days1-12/+35
| | | | | | | | | | POST /admin/quarantine/{id}/replay needs write on _continuum, which never covers user data, and replayed every path of the entry as the user who asked: every node refused the user data in it. It now replays only the paths the user may write and keeps the rest in the entry (left), for one who may; 403 if the user may write none. Review finding 3 (quarantine replays).
* swarm: changes taken unjudged, dropped (REFUSALS)tv4 days1-0/+17
| | | | | | | | | A node refusing changes a peer brought tells it which broke a rule; the peer judges them itself, and if its rules refuse them too, drops them with all built on them (its document forked without them, a fresh actor), quarantining its own writes among them. Wire version 42. Auth plan M6 (rejoin on taint).
* remake: replays keep their writerstv4 days4-25/+198
| | | | | | | | A remake's replay writes each value as the user who wrote it, splitting where several users wrote under a path, so replays are judged as the original writes. Auth plan M6 (remakes, 2.4).
* remake: forgetting and releasing name their usertv4 days2-2/+22
| | | | | | | Forget records and released quarantines name the user who made them, so they are judged by its capabilities. Auth plan M6.
* store: keys_at tells no map from an empty onetv4 days3-3/+8
| | | | | | | | registry::exists counted any value at _continuum/users as a registry; keys_at answers None where there is no map, and its users (records, members, forget records, remakes) say what they make of it. Auth plan M1 (fix).
* refuse misplaced authorstv5 days1-0/+9
|
* dashboard: polish remake ringstv5 days1-1/+17
|
* dashboard: remake switch delaytv5 days1-1/+1
|
* dashboard: add epoch switch indicatortv7 days2-7/+33
|
* dashboard: map remake votestv7 days1-0/+37
|
* fixup 700, 701, 702tv8 days1-38/+2
|
* remake: read ops, not diffstv9 days2-6/+6
| | | | This gives bench_replay a speedup of ~8x/64x/280x.
* api: add type caststv9 days1-0/+1
|
* add remake benchmarkstv9 days2-0/+91
|
* remake: download wakes on end instead of tickertv10 days2-6/+15
|
* remake: decouple grace time from node's keepalivetv10 days4-4/+25
|
* document: allow writes during rejointv10 days4-214/+271
|
* LWW everywhere, mostlytv10 days4-23/+340
|
* remake: copy stale view when writes stoptv10 days2-5/+11
| | | | This ensures that stale reads show every write that was answered.
* remake: log expired and missed votestv10 days2-9/+61
|
* api: off clock refuses aborting expired remaketv10 days1-14/+29
|
* remake: introduce follow-the-majority ruletv10 days1-27/+139
|
* document: reject writes during rejointv10 days4-31/+72
|
* use Automerge as Document instead of AutoCommittv11 days9-144/+174
| | | | This allows a lot of operations to drop mut.
* store function accept any documenttv11 days1-6/+10
|
* tests write through document::testing helperstv11 days5-210/+210
|
* remake coordination use document, not automergetv11 days6-46/+41
|
* one function for changed pathstv11 days1-27/+6
|
* remake needs sane clocktv11 days2-1/+22
|
* remake: drop is_reserved; use is_protocoltv11 days1-10/+5
|
* remake: drop parse_metadatatv11 days1-12/+8
|
* replace EpochInfo by EpochRecordtv11 days1-16/+1
|
* remake: move proposal to its own moduletv11 days3-252/+271
|
* move ChangeSet from swarm to documenttv11 days3-3/+3
|
* talk about "transport" unless mycelium is meanttv2026-10-271-3/+3
|
* remake worker wakes up when vote is duetv2026-10-264-2/+42
|
* describe remake test failures in simulationtv2026-10-261-0/+30
|
* make clippy happy againtv2026-10-263-16/+17
|
* add remake tests on the simulatortv2026-10-262-0/+57
|
* add changed_path minimality testtv2026-10-261-0/+69
|
* add epoch retention teststv2026-10-261-0/+29
|
* add test ensuring at most one remake commitstv2026-10-261-0/+151
|
* don't cast votes after committv2026-10-261-2/+14
|
* add remake statstv2026-10-262-0/+47
|
* introduce bounded blob downloadstv2026-10-262-5/+8
|
* allow aborting remake with unreachable coordiantortv2026-10-261-4/+26
|
* remove some dead commentstv2026-10-261-5/+3
|
* don't cast votes once there's a majoritytv2026-10-262-4/+48
|